Crypto lending total value locked has surged 55 percent since early July, reaching approximately $56 billion in assets after a sharp contraction in the second quarter.
The sector shed $11.33 billion in Q2, a 16.78 percent decline that followed the April Kelp DAO exploit. That hack exposed a vulnerability in how lending protocols evaluate collateral quality across chain boundaries.
The Kelp DAO incident minted 116,500 unbacked rsETH tokens—roughly $290 million in value—through a cross-chain route exploit. These tokens were then used as collateral to borrow on Aave markets. Although Aave's own contracts remained intact, the protocol saw deposits fall by approximately $15 billion in the days following the exploit. Aave froze rsETH and wrsETH markets in response.
Stani Kulechov, founder and CEO of Aave Labs, said Aave now treats interconnected security as a core priority. "Security cannot stop at the smart contract level," Kulechov said. Traditional audits overlook risks embedded in bridges, verifier networks, and other infrastructure an asset depends on. Aave introduced quarterly re-review cycles for all supported assets.
Spark implemented similar expansions to its vetting process. Sam MacPherson, Spark's CEO, said the team now evaluates governance design, operational security, collateral quality, liquidity management and ecosystem dependencies alongside smart contract security. Spark phased out rsETH on SparkLend in January, before the April exploit, after determining the asset's low utilization and revenue did not offset its risk.
Thomas Wu, chief financial officer of Bitcoin-backed lender Ledn, framed the issue as an expanding attack surface. "Every wrap bridge, and oracle between a lender and the underlying asset is another potential point of failure," Wu said.
Sid Powell, co-founder and CEO of crypto credit platform Maple, said serious lenders must assume any borrower can default at any time and work backward from that constraint when building risk models.
